{"record":{"id":"29d41fc70dda2afe","repo":"docker/cli","slug":"invalid-credential-spec-spec-specifies-config-v","errorCode":null,"errorMessage":"invalid credential spec: spec specifies config %v, but no such config can be found","messagePattern":"invalid credential spec: spec specifies config (.+?), but no such config can be found","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/compose/convert/service.go","lineNumber":721,"sourceCode":"\t}\n\tswarmCredSpec := swarm.CredentialSpec(spec)\n\t// if we're using a swarm Config for the credential spec, over-write it\n\t// here with the config ID\n\tif swarmCredSpec.Config != \"\" {\n\t\tfor _, config := range refs {\n\t\t\tif swarmCredSpec.Config == config.ConfigName {\n\t\t\t\tswarmCredSpec.Config = config.ConfigID\n\t\t\t\treturn &swarmCredSpec, nil\n\t\t\t}\n\t\t}\n\t\t// if none of the configs match, try namespacing\n\t\tfor _, config := range refs {\n\t\t\tif namespace.Scope(swarmCredSpec.Config) == config.ConfigName {\n\t\t\t\tswarmCredSpec.Config = config.ConfigID\n\t\t\t\treturn &swarmCredSpec, nil\n\t\t\t}\n\t\t}\n\t\treturn nil, fmt.Errorf(\"invalid credential spec: spec specifies config %v, but no such config can be found\", swarmCredSpec.Config)\n\t}\n\treturn &swarmCredSpec, nil\n}\n\nfunc convertUlimits(origUlimits map[string]*composetypes.UlimitsConfig) []*container.Ulimit {\n\tulimits := make([]*container.Ulimit, 0, len(origUlimits))\n\tfor name, u := range origUlimits {\n\t\tsoft, hard := int64(u.Soft), int64(u.Hard)\n\t\tif u.Single != 0 {\n\t\t\tsoft, hard = int64(u.Single), int64(u.Single)\n\t\t}\n\n\t\tulimits = append(ulimits, &container.Ulimit{\n\t\t\tName: name,\n\t\t\tSoft: soft,\n\t\t\tHard: hard,\n\t\t})\n\t}","sourceCodeStart":703,"sourceCodeEnd":739,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/compose/convert/service.go#L703-L739","documentation":"Returned by convertCredentialSpec when the spec names a config but none of the already-built ConfigReferences match it, even after namespacing (service.go:707-721). The credential spec needs the config's runtime ID, so the referenced config must be one the service actually mounts/uses.","triggerScenarios":"Setting credential_spec.config to a name that is not in the service's configs list AND not resolvable via the namespace scope of any existing ConfigReference. Both the direct-name loop (service.go:708-713) and the namespaced loop (service.go:715-720) fail to find a match.","commonSituations":"credential_spec.config names a config that isn't declared under the service's `configs:`; typos; referencing a config by a name that only exists external but isn't mounted.","solutions":["Ensure the config named in credential_spec.config is also listed in the service's `configs:` block.","Check spelling/casing of the config name in both places.","If the config is external, declare and mount it so a ConfigReference exists to resolve the ID."],"exampleFix":"// before\nservices:\n  web:\n    image: iis\n    credential_spec:\n      config: gmsa-cred\n// after\nservices:\n  web:\n    image: iis\n    credential_spec:\n      config: gmsa-cred\n    configs:\n      - gmsa-cred\nconfigs:\n  gmsa-cred:\n    external: true","handlingStrategy":"validation","validationCode":"// Ensure the config named by credential_spec.config is also mounted by the service.\nfunc validateCredentialSpecConfig(cfg *composetypes.Config) error {\n    for _, svc := range cfg.Services {\n        name := svc.CredentialSpec.Config\n        if name == \"\" {\n            continue\n        }\n        found := false\n        for _, c := range svc.Configs {\n            if c.Source == name { found = true; break }\n        }\n        if !found {\n            return fmt.Errorf(\"credential_spec config %q must be listed in the service configs\", name)\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always mount (via the service's configs:) any config referenced by credential_spec.config.","Double-check spelling/casing of the config name in both places.","For external configs, declare and mount them so a resolvable ConfigReference exists."],"tags":["compose","convert","credential-spec","configs","swarm","windows","gmsa"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}